Maltego

Maltego is an open source intelligence (OSINT) and link analysis tool that turns scattered data into a visual graph. You start from one piece of data, such as a domain, an email address or a company name, and Maltego queries public and commercial sources to show how it relates to other entities. It is widely used for pentest reconnaissance, fraud investigations, threat intelligence and investigative journalism.

What is Maltego?

Maltego is a desktop application (Windows, macOS and Linux) developed by Maltego Technologies, formerly known as Paterva. Its model is built on three concepts:

• Entities: the nodes in the graph (domain, IP, person, email, organisation, phone number, etc.).
• Transforms: queries that take an entity and return related entities. For example, from a domain to its DNS records or associated email addresses.
• Transform Hub: the catalogue of third-party integrations (threat intelligence feeds, registration databases, social networks…), some free and some requiring their own subscription.

The result is a map you can rearrange, filter and export, something that would be very hard to see in plain text lists.

What Maltego is used for

• Pentest reconnaissance: mapping an organisation's external surface (domains, subdomains, IPs, shared infrastructure) within the authorised scope.
• Threat intelligence: linking indicators of compromise (domains, hashes, IPs) to known campaigns or infrastructure.
• Fraud and phishing investigations: finding which domains share a registrant, server or certificate.
• Social engineering assessments: understanding a company's public exposure in authorised awareness programmes.

Responsible use: stick to authorised investigations and respect data protection law (such as the GDPR). Collecting personal data without a legitimate basis can be illegal even if it is public.

How to get started with Maltego

1. Download the client from the official website; on Kali Linux it is also available as the maltego package.
2. Create an account and activate the edition that matches your plan.
3. On first launch, browse the Transform Hub and install the free integrations you need.
4. Create a new graph, drag an entity from the palette (for example Domain) and type the value.
5. Right-click the entity and run a transform or a machine (a predefined sequence of transforms).

# Kali Linux
sudo apt update && sudo apt install maltego

Example workflow

A typical reconnaissance on your own domain or one a client has authorised:

1. Add a Domain entity with the target domain.
2. Run DNS transforms to get MX and NS records and known subdomains.
3. Resolve those names to IP addresses and group them by netblock or provider.
4. Look for published email addresses tied to the domain to understand the organisation's address format.
5. Switch to tree or block layout to spot shared infrastructure or forgotten domains.
6. Export the graph or a report to document findings.

The value lies in spotting patterns: for example, an old subdomain pointing at a server nobody maintains any more.

Pro tips

• Start with a few transforms and expand gradually: a graph with thousands of nodes becomes unreadable.
• Use colour markers and notes to separate confirmed findings from hypotheses.
• Combine Maltego with command-line tools and import results as entities to keep everything in one graph.
• Check your plan's result and query limits before a large investigation.

Pros and cons

Pros	Cons
Very powerful relationship visualisation	Full features are paid
Huge catalogue of integrations	Initial learning curve
A standard in OSINT and threat intel	Some sources require separate subscriptions

Maltego alternatives

• Sherlock: searches usernames across hundreds of social networks from the terminal.
• OpenCTI: an open threat intelligence platform with a relationship graph.
• Social Engineering (Hadnagy): the reference book for the human side of OSINT.

Frequently asked questions

Is Maltego free?

Not entirely. Maltego has historically offered a free community edition with limitations, alongside paid plans for professional use. Terms have changed over time, so check the current plans and prices on the official website.

Is Maltego legal?

Yes, the tool is legal and used by companies and law enforcement. What you need to watch is how you use it: investigate only with authorisation and in line with data protection law.

How do you use Maltego?

You add an entity to the graph, run transforms on it and analyse the relationships that appear. Start with your own domain to understand each kind of transform.

Does Maltego come with Kali Linux?

Yes, Kali includes the Maltego package, although you still need an account to activate it.

If you want to strengthen the networking, DNS and Linux basics behind reconnaissance, practise at the Hackers en Acción Academy.